source3/libsmb/clifsinfo.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    FS info functions
   4    Copyright (C) Stefan (metze) Metzmacher      2003
   5    Copyright (C) Jeremy Allison 2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "libsmb/libsmb.h"
  23 #include "../libcli/auth/spnego.h"
  24 #include "../auth/ntlmssp/ntlmssp.h"
  25 #include "../lib/util/tevent_ntstatus.h"
  26 #include "async_smb.h"
  27 #include "smb_crypt.h"
  28 #include "trans2.h"
  29 #include "ntlmssp_wrap.h"
  30
  31 /****************************************************************************
  32  Get UNIX extensions version info.
  33 ****************************************************************************/
  34
  35 struct cli_unix_extensions_version_state {
  36         struct cli_state *cli;
  37         uint16_t setup[1];
  38         uint8_t param[2];
  39         uint16_t major, minor;
  40         uint32_t caplow, caphigh;
  41 };
  42
  43 static void cli_unix_extensions_version_done(struct tevent_req *subreq);
  44
  45 struct tevent_req *cli_unix_extensions_version_send(TALLOC_CTX *mem_ctx,
  46                                                     struct tevent_context *ev,
  47                                                     struct cli_state *cli)
  48 {
  49         struct tevent_req *req, *subreq;
  50         struct cli_unix_extensions_version_state *state;
  51
  52         req = tevent_req_create(mem_ctx, &state,
  53                                 struct cli_unix_extensions_version_state);
  54         if (req == NULL) {
  55                 return NULL;
  56         }
  57         state->cli = cli;
  58         SSVAL(state->setup, 0, TRANSACT2_QFSINFO);
  59         SSVAL(state->param, 0, SMB_QUERY_CIFS_UNIX_INFO);
  60
  61         subreq = cli_trans_send(state, ev, cli, SMBtrans2,
  62                                 NULL, 0, 0, 0,
  63                                 state->setup, 1, 0,
  64                                 state->param, 2, 0,
  65                                 NULL, 0, 560);
  66         if (tevent_req_nomem(subreq, req)) {
  67                 return tevent_req_post(req, ev);
  68         }
  69         tevent_req_set_callback(subreq, cli_unix_extensions_version_done, req);
  70         return req;
  71 }
  72
  73 static void cli_unix_extensions_version_done(struct tevent_req *subreq)
  74 {
  75         struct tevent_req *req = tevent_req_callback_data(
  76                 subreq, struct tevent_req);
  77         struct cli_unix_extensions_version_state *state = tevent_req_data(
  78                 req, struct cli_unix_extensions_version_state);
  79         uint8_t *data;
  80         uint32_t num_data;
  81         NTSTATUS status;
  82
  83         status = cli_trans_recv(subreq, state, NULL, NULL, 0, NULL,
  84                                 NULL, 0, NULL, &data, 12, &num_data);
  85         TALLOC_FREE(subreq);
  86         if (!NT_STATUS_IS_OK(status)) {
  87                 tevent_req_nterror(req, status);
  88                 return;
  89         }
  90
  91         state->major = SVAL(data, 0);
  92         state->minor = SVAL(data, 2);
  93         state->caplow = IVAL(data, 4);
  94         state->caphigh = IVAL(data, 8);
  95         TALLOC_FREE(data);
  96         tevent_req_done(req);
  97 }
  98
  99 NTSTATUS cli_unix_extensions_version_recv(struct tevent_req *req,
 100                                           uint16_t *pmajor, uint16_t *pminor,
 101                                           uint32_t *pcaplow,
 102                                           uint32_t *pcaphigh)
 103 {
 104         struct cli_unix_extensions_version_state *state = tevent_req_data(
 105                 req, struct cli_unix_extensions_version_state);
 106         NTSTATUS status;
 107
 108         if (tevent_req_is_nterror(req, &status)) {
 109                 return status;
 110         }
 111         *pmajor = state->major;
 112         *pminor = state->minor;
 113         *pcaplow = state->caplow;
 114         *pcaphigh = state->caphigh;
 115         state->cli->server_posix_capabilities = *pcaplow;
 116         return NT_STATUS_OK;
 117 }
 118
 119 NTSTATUS cli_unix_extensions_version(struct cli_state *cli, uint16 *pmajor,
 120                                      uint16 *pminor, uint32 *pcaplow,
 121                                      uint32 *pcaphigh)
 122 {
 123         TALLOC_CTX *frame = talloc_stackframe();
 124         struct event_context *ev;
 125         struct tevent_req *req;
 126         NTSTATUS status = NT_STATUS_OK;
 127
 128         if (cli_has_async_calls(cli)) {
 129                 /*
 130                  * Can't use sync call while an async call is in flight
 131                  */
 132                 status = NT_STATUS_INVALID_PARAMETER;
 133                 goto fail;
 134         }
 135
 136         ev = event_context_init(frame);
 137         if (ev == NULL) {
 138                 status = NT_STATUS_NO_MEMORY;
 139                 goto fail;
 140         }
 141
 142         req = cli_unix_extensions_version_send(frame, ev, cli);
 143         if (req == NULL) {
 144                 status = NT_STATUS_NO_MEMORY;
 145                 goto fail;
 146         }
 147
 148         if (!tevent_req_poll(req, ev)) {
 149                 status = map_nt_error_from_unix(errno);
 150                 goto fail;
 151         }
 152
 153         status = cli_unix_extensions_version_recv(req, pmajor, pminor, pcaplow,
 154                                                   pcaphigh);
 155  fail:
 156         TALLOC_FREE(frame);
 157         return status;
 158 }
 159
 160 /****************************************************************************
 161  Set UNIX extensions capabilities.
 162 ****************************************************************************/
 163
 164 struct cli_set_unix_extensions_capabilities_state {
 165         struct cli_state *cli;
 166         uint16_t setup[1];
 167         uint8_t param[4];
 168         uint8_t data[12];
 169 };
 170
 171 static void cli_set_unix_extensions_capabilities_done(
 172         struct tevent_req *subreq);
 173
 174 struct tevent_req *cli_set_unix_extensions_capabilities_send(
 175         TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
 176         uint16_t major, uint16_t minor, uint32_t caplow, uint32_t caphigh)
 177 {
 178         struct tevent_req *req, *subreq;
 179         struct cli_set_unix_extensions_capabilities_state *state;
 180
 181         req = tevent_req_create(
 182                 mem_ctx, &state,
 183                 struct cli_set_unix_extensions_capabilities_state);
 184         if (req == NULL) {
 185                 return NULL;
 186         }
 187
 188         state->cli = cli;
 189         SSVAL(state->setup+0, 0, TRANSACT2_SETFSINFO);
 190
 191         SSVAL(state->param, 0, 0);
 192         SSVAL(state->param, 2, SMB_SET_CIFS_UNIX_INFO);
 193
 194         SSVAL(state->data, 0, major);
 195         SSVAL(state->data, 2, minor);
 196         SIVAL(state->data, 4, caplow);
 197         SIVAL(state->data, 8, caphigh);
 198
 199         subreq = cli_trans_send(state, ev, cli, SMBtrans2,
 200                                 NULL, 0, 0, 0,
 201                                 state->setup, 1, 0,
 202                                 state->param, 4, 0,
 203                                 state->data, 12, 560);
 204         if (tevent_req_nomem(subreq, req)) {
 205                 return tevent_req_post(req, ev);
 206         }
 207         tevent_req_set_callback(
 208                 subreq, cli_set_unix_extensions_capabilities_done, req);
 209         return req;
 210 }
 211
 212 static void cli_set_unix_extensions_capabilities_done(
 213         struct tevent_req *subreq)
 214 {
 215         struct tevent_req *req = tevent_req_callback_data(
 216                 subreq, struct tevent_req);
 217         struct cli_set_unix_extensions_capabilities_state *state = tevent_req_data(
 218                 req, struct cli_set_unix_extensions_capabilities_state);
 219
 220         NTSTATUS status = cli_trans_recv(subreq, NULL, NULL, NULL, 0, NULL,
 221                                          NULL, 0, NULL, NULL, 0, NULL);
 222         if (NT_STATUS_IS_OK(status)) {
 223                 state->cli->requested_posix_capabilities = IVAL(state->data, 4);
 224         }
 225         tevent_req_simple_finish_ntstatus(subreq, status);
 226 }
 227
 228 NTSTATUS cli_set_unix_extensions_capabilities_recv(struct tevent_req *req)
 229 {
 230         return tevent_req_simple_recv_ntstatus(req);
 231 }
 232
 233 NTSTATUS cli_set_unix_extensions_capabilities(struct cli_state *cli,
 234                                               uint16 major, uint16 minor,
 235                                               uint32 caplow, uint32 caphigh)
 236 {
 237         struct tevent_context *ev;
 238         struct tevent_req *req;
 239         NTSTATUS status = NT_STATUS_NO_MEMORY;
 240
 241         if (cli_has_async_calls(cli)) {
 242                 return NT_STATUS_INVALID_PARAMETER;
 243         }
 244         ev = tevent_context_init(talloc_tos());
 245         if (ev == NULL) {
 246                 goto fail;
 247         }
 248         req = cli_set_unix_extensions_capabilities_send(
 249                 ev, ev, cli, major, minor, caplow, caphigh);
 250         if (req == NULL) {
 251                 goto fail;
 252         }
 253         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
 254                 goto fail;
 255         }
 256         status = cli_set_unix_extensions_capabilities_recv(req);
 257 fail:
 258         TALLOC_FREE(ev);
 259         return status;
 260 }
 261
 262 struct cli_get_fs_attr_info_state {
 263         uint16_t setup[1];
 264         uint8_t param[2];
 265         uint32_t fs_attr;
 266 };
 267
 268 static void cli_get_fs_attr_info_done(struct tevent_req *subreq);
 269
 270 struct tevent_req *cli_get_fs_attr_info_send(TALLOC_CTX *mem_ctx,
 271                                              struct tevent_context *ev,
 272                                              struct cli_state *cli)
 273 {
 274         struct tevent_req *subreq, *req;
 275         struct cli_get_fs_attr_info_state *state;
 276
 277         req = tevent_req_create(mem_ctx, &state,
 278                                 struct cli_get_fs_attr_info_state);
 279         if (req == NULL) {
 280                 return NULL;
 281         }
 282         SSVAL(state->setup+0, 0, TRANSACT2_QFSINFO);
 283         SSVAL(state->param+0, 0, SMB_QUERY_FS_ATTRIBUTE_INFO);
 284
 285         subreq = cli_trans_send(state, ev, cli, SMBtrans2,
 286                                 NULL, 0, 0, 0,
 287                                 state->setup, 1, 0,
 288                                 state->param, 2, 0,
 289                                 NULL, 0, 560);
 290         if (tevent_req_nomem(subreq, req)) {
 291                 return tevent_req_post(req, ev);
 292         }
 293         tevent_req_set_callback(subreq, cli_get_fs_attr_info_done, req);
 294         return req;
 295 }
 296
 297 static void cli_get_fs_attr_info_done(struct tevent_req *subreq)
 298 {
 299         struct tevent_req *req = tevent_req_callback_data(
 300                 subreq, struct tevent_req);
 301         struct cli_get_fs_attr_info_state *state = tevent_req_data(
 302                 req, struct cli_get_fs_attr_info_state);
 303         uint8_t *data;
 304         uint32_t num_data;
 305         NTSTATUS status;
 306
 307         status = cli_trans_recv(subreq, talloc_tos(), NULL, NULL, 0, NULL,
 308                                 NULL, 0, NULL, &data, 12, &num_data);
 309         TALLOC_FREE(subreq);
 310         if (!NT_STATUS_IS_OK(status)) {
 311                 tevent_req_nterror(req, status);
 312                 return;
 313         }
 314         state->fs_attr = IVAL(data, 0);
 315         TALLOC_FREE(data);
 316         tevent_req_done(req);
 317 }
 318
 319 NTSTATUS cli_get_fs_attr_info_recv(struct tevent_req *req, uint32_t *fs_attr)
 320 {
 321         struct cli_get_fs_attr_info_state *state = tevent_req_data(
 322                 req, struct cli_get_fs_attr_info_state);
 323         NTSTATUS status;
 324
 325         if (tevent_req_is_nterror(req, &status)) {
 326                 return status;
 327         }
 328         *fs_attr = state->fs_attr;
 329         return NT_STATUS_OK;
 330 }
 331
 332 NTSTATUS cli_get_fs_attr_info(struct cli_state *cli, uint32_t *fs_attr)
 333 {
 334         struct tevent_context *ev;
 335         struct tevent_req *req;
 336         NTSTATUS status = NT_STATUS_NO_MEMORY;
 337
 338         if (cli_has_async_calls(cli)) {
 339                 return NT_STATUS_INVALID_PARAMETER;
 340         }
 341         ev = tevent_context_init(talloc_tos());
 342         if (ev == NULL) {
 343                 goto fail;
 344         }
 345         req = cli_get_fs_attr_info_send(ev, ev, cli);
 346         if (req == NULL) {
 347                 goto fail;
 348         }
 349         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
 350                 goto fail;
 351         }
 352         status = cli_get_fs_attr_info_recv(req, fs_attr);
 353 fail:
 354         TALLOC_FREE(ev);
 355         return status;
 356 }
 357
 358 NTSTATUS cli_get_fs_volume_info(struct cli_state *cli,
 359                                 TALLOC_CTX *mem_ctx,
 360                                 char **_volume_name,
 361                                 uint32_t *pserial_number,
 362                                 time_t *pdate)
 363 {
 364         NTSTATUS status;
 365         uint16_t recv_flags2;
 366         uint16_t setup[1];
 367         uint8_t param[2];
 368         uint8_t *rdata;
 369         uint32_t rdata_count;
 370         unsigned int nlen;
 371         char *volume_name = NULL;
 372
 373         SSVAL(setup, 0, TRANSACT2_QFSINFO);
 374         SSVAL(param,0,SMB_QUERY_FS_VOLUME_INFO);
 375
 376         status = cli_trans(talloc_tos(), cli, SMBtrans2,
 377                            NULL, 0, 0, 0,
 378                            setup, 1, 0,
 379                            param, 2, 0,
 380                            NULL, 0, 560,
 381                            &recv_flags2,
 382                            NULL, 0, NULL,
 383                            NULL, 0, NULL,
 384                            &rdata, 18, &rdata_count);
 385         if (!NT_STATUS_IS_OK(status)) {
 386                 return status;
 387         }
 388
 389         if (pdate) {
 390                 struct timespec ts;
 391                 ts = interpret_long_date((char *)rdata);
 392                 *pdate = ts.tv_sec;
 393         }
 394         if (pserial_number) {
 395                 *pserial_number = IVAL(rdata,8);
 396         }
 397         nlen = IVAL(rdata,12);
 398         if (nlen > (rdata_count - 18)) {
 399                 TALLOC_FREE(rdata);
 400                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 401         }
 402
 403         clistr_pull_talloc(mem_ctx,
 404                            (const char *)rdata,
 405                            recv_flags2,
 406                            &volume_name,
 407                            rdata + 18,
 408                            nlen, STR_UNICODE);
 409         if (volume_name == NULL) {
 410                 status = map_nt_error_from_unix(errno);
 411                 TALLOC_FREE(rdata);
 412                 return status;
 413         }
 414
 415         /* todo: but not yet needed
 416          *       return the other stuff
 417          */
 418
 419         *_volume_name = volume_name;
 420         TALLOC_FREE(rdata);
 421         return NT_STATUS_OK;
 422 }
 423
 424 NTSTATUS cli_get_fs_full_size_info(struct cli_state *cli,
 425                                    uint64_t *total_allocation_units,
 426                                    uint64_t *caller_allocation_units,
 427                                    uint64_t *actual_allocation_units,
 428                                    uint64_t *sectors_per_allocation_unit,
 429                                    uint64_t *bytes_per_sector)
 430 {
 431         uint16 setup[1];
 432         uint8_t param[2];
 433         uint8_t *rdata = NULL;
 434         uint32_t rdata_count;
 435         NTSTATUS status;
 436
 437         SSVAL(setup, 0, TRANSACT2_QFSINFO);
 438         SSVAL(param, 0, SMB_FS_FULL_SIZE_INFORMATION);
 439
 440         status = cli_trans(talloc_tos(), cli, SMBtrans2,
 441                            NULL, 0, 0, 0,
 442                            setup, 1, 0, /* setup */
 443                            param, 2, 0,  /* param */
 444                            NULL, 0, 560, /* data */
 445                            NULL,
 446                            NULL, 0, NULL, /* rsetup */
 447                            NULL, 0, NULL, /* rparam */
 448                            &rdata, 32, &rdata_count);  /* rdata */
 449         if (!NT_STATUS_IS_OK(status)) {
 450                 goto fail;
 451         }
 452
 453         if (total_allocation_units) {
 454                 *total_allocation_units = BIG_UINT(rdata, 0);
 455         }
 456         if (caller_allocation_units) {
 457                 *caller_allocation_units = BIG_UINT(rdata,8);
 458         }
 459         if (actual_allocation_units) {
 460                 *actual_allocation_units = BIG_UINT(rdata,16);
 461         }
 462         if (sectors_per_allocation_unit) {
 463                 *sectors_per_allocation_unit = IVAL(rdata,24);
 464         }
 465         if (bytes_per_sector) {
 466                 *bytes_per_sector = IVAL(rdata,28);
 467         }
 468
 469 fail:
 470         TALLOC_FREE(rdata);
 471         return status;
 472 }
 473
 474 NTSTATUS cli_get_posix_fs_info(struct cli_state *cli,
 475                                uint32 *optimal_transfer_size,
 476                                uint32 *block_size,
 477                                uint64_t *total_blocks,
 478                                uint64_t *blocks_available,
 479                                uint64_t *user_blocks_available,
 480                                uint64_t *total_file_nodes,
 481                                uint64_t *free_file_nodes,
 482                                uint64_t *fs_identifier)
 483 {
 484         uint16 setup[1];
 485         uint8_t param[2];
 486         uint8_t *rdata = NULL;
 487         uint32_t rdata_count;
 488         NTSTATUS status;
 489
 490         SSVAL(setup, 0, TRANSACT2_QFSINFO);
 491         SSVAL(param,0,SMB_QUERY_POSIX_FS_INFO);
 492
 493         status = cli_trans(talloc_tos(), cli, SMBtrans2, NULL, 0, 0, 0,
 494                            setup, 1, 0,
 495                            param, 2, 0,
 496                            NULL, 0, 560,
 497                            NULL,
 498                            NULL, 0, NULL, /* rsetup */
 499                            NULL, 0, NULL, /* rparam */
 500                            &rdata, 56, &rdata_count);
 501         if (!NT_STATUS_IS_OK(status)) {
 502                 return status;
 503         }
 504
 505         if (optimal_transfer_size) {
 506                 *optimal_transfer_size = IVAL(rdata, 0);
 507         }
 508         if (block_size) {
 509                 *block_size = IVAL(rdata,4);
 510         }
 511         if (total_blocks) {
 512                 *total_blocks = BIG_UINT(rdata,8);
 513         }
 514         if (blocks_available) {
 515                 *blocks_available = BIG_UINT(rdata,16);
 516         }
 517         if (user_blocks_available) {
 518                 *user_blocks_available = BIG_UINT(rdata,24);
 519         }
 520         if (total_file_nodes) {
 521                 *total_file_nodes = BIG_UINT(rdata,32);
 522         }
 523         if (free_file_nodes) {
 524                 *free_file_nodes = BIG_UINT(rdata,40);
 525         }
 526         if (fs_identifier) {
 527                 *fs_identifier = BIG_UINT(rdata,48);
 528         }
 529         return NT_STATUS_OK;
 530 }
 531
 532
 533 /******************************************************************************
 534  Send/receive the request encryption blob.
 535 ******************************************************************************/
 536
 537 static NTSTATUS enc_blob_send_receive(struct cli_state *cli, DATA_BLOB *in, DATA_BLOB *out, DATA_BLOB *param_out)
 538 {
 539         uint16_t setup[1];
 540         uint8_t param[4];
 541         uint8_t *rparam=NULL, *rdata=NULL;
 542         uint32_t num_rparam, num_rdata;
 543         NTSTATUS status;
 544
 545         SSVAL(setup+0, 0, TRANSACT2_SETFSINFO);
 546         SSVAL(param,0,0);
 547         SSVAL(param,2,SMB_REQUEST_TRANSPORT_ENCRYPTION);
 548
 549         status = cli_trans(talloc_tos(), cli, SMBtrans2, NULL, 0, 0, 0,
 550                            setup, 1, 0,
 551                            param, 4, 2,
 552                            (uint8_t *)in->data, in->length, CLI_BUFFER_SIZE,
 553                            NULL,          /* recv_flags */
 554                            NULL, 0, NULL, /* rsetup */
 555                            &rparam, 0, &num_rparam,
 556                            &rdata, 0, &num_rdata);
 557
 558         if (!NT_STATUS_IS_OK(status) &&
 559             !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 560                 return status;
 561         }
 562
 563         *out = data_blob(rdata, num_rdata);
 564         *param_out = data_blob(rparam, num_rparam);
 565
 566         TALLOC_FREE(rparam);
 567         TALLOC_FREE(rdata);
 568         return status;
 569 }
 570
 571 /******************************************************************************
 572  Make a client state struct.
 573 ******************************************************************************/
 574
 575 static struct smb_trans_enc_state *make_cli_enc_state(enum smb_trans_enc_type smb_enc_type)
 576 {
 577         struct smb_trans_enc_state *es = NULL;
 578         es = SMB_MALLOC_P(struct smb_trans_enc_state);
 579         if (!es) {
 580                 return NULL;
 581         }
 582         ZERO_STRUCTP(es);
 583         es->smb_enc_type = smb_enc_type;
 584
 585 #if defined(HAVE_GSSAPI) && defined(HAVE_KRB5)
 586         if (smb_enc_type == SMB_TRANS_ENC_GSS) {
 587                 es->s.gss_state = SMB_MALLOC_P(struct smb_tran_enc_state_gss);
 588                 if (!es->s.gss_state) {
 589                         SAFE_FREE(es);
 590                         return NULL;
 591                 }
 592                 ZERO_STRUCTP(es->s.gss_state);
 593         }
 594 #endif
 595         return es;
 596 }
 597
 598 /******************************************************************************
 599  Start a raw ntlmssp encryption.
 600 ******************************************************************************/
 601
 602 NTSTATUS cli_raw_ntlm_smb_encryption_start(struct cli_state *cli,
 603                                 const char *user,
 604                                 const char *pass,
 605                                 const char *domain)
 606 {
 607         DATA_BLOB blob_in = data_blob_null;
 608         DATA_BLOB blob_out = data_blob_null;
 609         DATA_BLOB param_out = data_blob_null;
 610         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 611         struct smb_trans_enc_state *es = make_cli_enc_state(SMB_TRANS_ENC_NTLM);
 612
 613         if (!es) {
 614                 return NT_STATUS_NO_MEMORY;
 615         }
 616         status = auth_ntlmssp_client_start(NULL,
 617                                       lp_netbios_name(),
 618                                       lp_workgroup(),
 619                                       lp_client_ntlmv2_auth(),
 620                                       &es->s.auth_ntlmssp_state);
 621         if (!NT_STATUS_IS_OK(status)) {
 622                 goto fail;
 623         }
 624
 625         auth_ntlmssp_want_feature(es->s.auth_ntlmssp_state, NTLMSSP_FEATURE_SESSION_KEY);
 626         auth_ntlmssp_want_feature(es->s.auth_ntlmssp_state, NTLMSSP_FEATURE_SEAL);
 627
 628         if (!NT_STATUS_IS_OK(status = auth_ntlmssp_set_username(es->s.auth_ntlmssp_state, user))) {
 629                 goto fail;
 630         }
 631         if (!NT_STATUS_IS_OK(status = auth_ntlmssp_set_domain(es->s.auth_ntlmssp_state, domain))) {
 632                 goto fail;
 633         }
 634         if (!NT_STATUS_IS_OK(status = auth_ntlmssp_set_password(es->s.auth_ntlmssp_state, pass))) {
 635                 goto fail;
 636         }
 637
 638         do {
 639                 status = auth_ntlmssp_update(es->s.auth_ntlmssp_state, es->s.auth_ntlmssp_state,
 640                                              blob_in, &blob_out);
 641                 data_blob_free(&blob_in);
 642                 data_blob_free(&param_out);
 643                 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) || NT_STATUS_IS_OK(status)) {
 644                         NTSTATUS trans_status = enc_blob_send_receive(cli,
 645                                                                         &blob_out,
 646                                                                         &blob_in,
 647                                                                         &param_out);
 648                         if (!NT_STATUS_EQUAL(trans_status,
 649                                         NT_STATUS_MORE_PROCESSING_REQUIRED) &&
 650                                         !NT_STATUS_IS_OK(trans_status)) {
 651                                 status = trans_status;
 652                         } else {
 653                                 if (param_out.length == 2) {
 654                                         es->enc_ctx_num = SVAL(param_out.data, 0);
 655                                 }
 656                         }
 657                 }
 658                 data_blob_free(&blob_out);
 659         } while (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED));
 660
 661         data_blob_free(&blob_in);
 662
 663         if (NT_STATUS_IS_OK(status)) {
 664                 /* Replace the old state, if any. */
 665                 if (cli->trans_enc_state) {
 666                         common_free_encryption_state(&cli->trans_enc_state);
 667                 }
 668                 cli->trans_enc_state = es;
 669                 cli->trans_enc_state->enc_on = True;
 670                 es = NULL;
 671         }
 672
 673   fail:
 674
 675         common_free_encryption_state(&es);
 676         return status;
 677 }
 678
 679 #if defined(HAVE_GSSAPI) && defined(HAVE_KRB5)
 680
 681 #ifndef SMB_GSS_REQUIRED_FLAGS
 682 #define SMB_GSS_REQUIRED_FLAGS (GSS_C_CONF_FLAG|GSS_C_INTEG_FLAG|GSS_C_MUTUAL_FLAG|GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG)
 683 #endif
 684
 685 /******************************************************************************
 686  Get client gss blob to send to a server.
 687 ******************************************************************************/
 688
 689 static NTSTATUS make_cli_gss_blob(TALLOC_CTX *ctx,
 690                                 struct smb_trans_enc_state *es,
 691                                 const char *service,
 692                                 const char *host,
 693                                 NTSTATUS status_in,
 694                                 DATA_BLOB spnego_blob_in,
 695                                 DATA_BLOB *p_blob_out)
 696 {
 697         const char *krb_mechs[] = {OID_KERBEROS5, NULL};
 698         OM_uint32 ret;
 699         OM_uint32 min;
 700         gss_name_t srv_name;
 701         gss_buffer_desc input_name;
 702         gss_buffer_desc *p_tok_in;
 703         gss_buffer_desc tok_out, tok_in;
 704         DATA_BLOB blob_out = data_blob_null;
 705         DATA_BLOB blob_in = data_blob_null;
 706         char *host_princ_s = NULL;
 707         OM_uint32 ret_flags = 0;
 708         NTSTATUS status = NT_STATUS_OK;
 709
 710         gss_OID_desc nt_hostbased_service =
 711         {10, discard_const_p(char, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x01\x04")};
 712
 713         memset(&tok_out, '\0', sizeof(tok_out));
 714
 715         /* Get a ticket for the service@host */
 716         if (asprintf(&host_princ_s, "%s@%s", service, host) == -1) {
 717                 return NT_STATUS_NO_MEMORY;
 718         }
 719
 720         input_name.value = host_princ_s;
 721         input_name.length = strlen(host_princ_s) + 1;
 722
 723         ret = gss_import_name(&min,
 724                                 &input_name,
 725                                 &nt_hostbased_service,
 726                                 &srv_name);
 727
 728         if (ret != GSS_S_COMPLETE) {
 729                 SAFE_FREE(host_princ_s);
 730                 return map_nt_error_from_gss(ret, min);
 731         }
 732
 733         if (spnego_blob_in.length == 0) {
 734                 p_tok_in = GSS_C_NO_BUFFER;
 735         } else {
 736                 /* Remove the SPNEGO wrapper */
 737                 if (!spnego_parse_auth_response(ctx, spnego_blob_in, status_in, OID_KERBEROS5, &blob_in)) {
 738                         status = NT_STATUS_UNSUCCESSFUL;
 739                         goto fail;
 740                 }
 741                 tok_in.value = blob_in.data;
 742                 tok_in.length = blob_in.length;
 743                 p_tok_in = &tok_in;
 744         }
 745
 746         ret = gss_init_sec_context(&min,
 747                                 GSS_C_NO_CREDENTIAL, /* Use our default cred. */
 748                                 &es->s.gss_state->gss_ctx,
 749                                 srv_name,
 750                                 GSS_C_NO_OID, /* default OID. */
 751                                 GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG | GSS_C_DELEG_FLAG,
 752                                 GSS_C_INDEFINITE,       /* requested ticket lifetime. */
 753                                 NULL,   /* no channel bindings */
 754                                 p_tok_in,
 755                                 NULL,   /* ignore mech type */
 756                                 &tok_out,
 757                                 &ret_flags,
 758                                 NULL);  /* ignore time_rec */
 759
 760         status = map_nt_error_from_gss(ret, min);
 761         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status,NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 762                 ADS_STATUS adss = ADS_ERROR_GSS(ret, min);
 763                 DEBUG(10,("make_cli_gss_blob: gss_init_sec_context failed with %s\n",
 764                         ads_errstr(adss)));
 765                 goto fail;
 766         }
 767
 768         if ((ret_flags & SMB_GSS_REQUIRED_FLAGS) != SMB_GSS_REQUIRED_FLAGS) {
 769                 status = NT_STATUS_ACCESS_DENIED;
 770         }
 771
 772         blob_out = data_blob_talloc(ctx, tok_out.value, tok_out.length);
 773
 774         /* Wrap in an SPNEGO wrapper */
 775         *p_blob_out = spnego_gen_negTokenInit(ctx, krb_mechs, &blob_out, NULL);
 776
 777   fail:
 778
 779         data_blob_free(&blob_out);
 780         data_blob_free(&blob_in);
 781         SAFE_FREE(host_princ_s);
 782         gss_release_name(&min, &srv_name);
 783         if (tok_out.value) {
 784                 gss_release_buffer(&min, &tok_out);
 785         }
 786         return status;
 787 }
 788
 789 /******************************************************************************
 790  Start a SPNEGO gssapi encryption context.
 791 ******************************************************************************/
 792
 793 NTSTATUS cli_gss_smb_encryption_start(struct cli_state *cli)
 794 {
 795         DATA_BLOB blob_recv = data_blob_null;
 796         DATA_BLOB blob_send = data_blob_null;
 797         DATA_BLOB param_out = data_blob_null;
 798         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 799         fstring fqdn;
 800         const char *servicename;
 801         struct smb_trans_enc_state *es = make_cli_enc_state(SMB_TRANS_ENC_GSS);
 802
 803         if (!es) {
 804                 return NT_STATUS_NO_MEMORY;
 805         }
 806
 807         name_to_fqdn(fqdn, cli_state_remote_name(cli));
 808         strlower_m(fqdn);
 809
 810         servicename = "cifs";
 811         status = make_cli_gss_blob(talloc_tos(), es, servicename, fqdn, NT_STATUS_OK, blob_recv, &blob_send);
 812         if (!NT_STATUS_EQUAL(status,NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 813                 servicename = "host";
 814                 status = make_cli_gss_blob(talloc_tos(), es, servicename, fqdn, NT_STATUS_OK, blob_recv, &blob_send);
 815                 if (!NT_STATUS_EQUAL(status,NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 816                         goto fail;
 817                 }
 818         }
 819
 820         do {
 821                 data_blob_free(&blob_recv);
 822                 status = enc_blob_send_receive(cli, &blob_send, &blob_recv, &param_out);
 823                 if (param_out.length == 2) {
 824                         es->enc_ctx_num = SVAL(param_out.data, 0);
 825                 }
 826                 data_blob_free(&blob_send);
 827                 status = make_cli_gss_blob(talloc_tos(), es, servicename, fqdn, status, blob_recv, &blob_send);
 828         } while (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED));
 829         data_blob_free(&blob_recv);
 830
 831         if (NT_STATUS_IS_OK(status)) {
 832                 /* Replace the old state, if any. */
 833                 if (cli->trans_enc_state) {
 834                         common_free_encryption_state(&cli->trans_enc_state);
 835                 }
 836                 cli->trans_enc_state = es;
 837                 cli->trans_enc_state->enc_on = True;
 838                 es = NULL;
 839         }
 840
 841   fail:
 842
 843         common_free_encryption_state(&es);
 844         return status;
 845 }
 846 #else
 847 NTSTATUS cli_gss_smb_encryption_start(struct cli_state *cli)
 848 {
 849         return NT_STATUS_NOT_SUPPORTED;
 850 }
 851 #endif
 852
 853 /********************************************************************
 854  Ensure a connection is encrypted.
 855 ********************************************************************/
 856
 857 NTSTATUS cli_force_encryption(struct cli_state *c,
 858                         const char *username,
 859                         const char *password,
 860                         const char *domain)
 861 {
 862         uint16 major, minor;
 863         uint32 caplow, caphigh;
 864         NTSTATUS status;
 865
 866         if (!SERVER_HAS_UNIX_CIFS(c)) {
 867                 return NT_STATUS_NOT_SUPPORTED;
 868         }
 869
 870         status = cli_unix_extensions_version(c, &major, &minor, &caplow,
 871                                              &caphigh);
 872         if (!NT_STATUS_IS_OK(status)) {
 873                 DEBUG(10, ("cli_force_encryption: cli_unix_extensions_version "
 874                            "returned %s\n", nt_errstr(status)));
 875                 return NT_STATUS_UNKNOWN_REVISION;
 876         }
 877
 878         if (!(caplow & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP)) {
 879                 return NT_STATUS_UNSUPPORTED_COMPRESSION;
 880         }
 881
 882         if (c->use_kerberos) {
 883                 return cli_gss_smb_encryption_start(c);
 884         }
 885         return cli_raw_ntlm_smb_encryption_start(c,
 886                                         username,
 887                                         password,
 888                                         domain);
 889 }